Security
How Tradepit keeps your exchange keys, what it stores about you and how to report a vulnerability.
Where your keys live
Your API key and its secret are stored only in this browser. The secret is imported as a key the page itself cannot read back, and it is used only to sign requests to the exchange. Orders go from your browser straight to the exchange. When you sign out, the keys are erased from the browser. Tradepit never receives your keys, so it cannot trade, withdraw or transfer on your account.
How to set up a key
Create a separate API key for Tradepit and give it only what trading needs.
- allow reading and trading on Spot and Futures
- turn off withdrawals and transfers between accounts
- if the exchange allows it, restrict the key to your own IP address
- consider a sub account that holds only the funds you trade
What Tradepit stores
Tradepit keeps only what the account needs, and nothing that gives access to your funds.
- your email and a hash of your password
- the screeners, scanners and patterns you create
- error logs of the page, to solve your problems quickly
A clean page
Tradepit loads no third party scripts and no advertising, so nothing else on the page can reach your keys. For the best protection keep your browser and system updated.
Reporting a vulnerability
Write to [email protected] with the steps to reproduce, and we will look into it right away.